By Abdi Ali
Sunday June 26, 2022
Somalia government’s recent assessment report, while
well-intentioned, is seriously flawed in focus and positively damaging to
Somalia’s financial services industry. Here is why.
Towards the end
of last month, Somalia’s Financial Reporting Centre (FRC) and Ministry of
Finance published the country’s national risk assessment (NRA) on money
laundering (ML) and terrorist financing (TF). This is an important assessment
that was intended to satisfy the seventh reform milestone of the Completion
Point Trigger conditionality for the Debt Relief programme. The NRA, which was
initially expected to be drafted by the end of 2020 and took three years to
complete, also informs Somalia’s national strategy for anti-money laundering
(AML) and countering the financing of terrorism (CFT). The outcome from the NRA
and national strategy will then form the basis for the upcoming evaluation by
the Financial
Action Task Force (FATF) in the third quarter of 2024. The NRA is also published
by the FATF, creating wider global visibility.
The whole basis
of the NRA is a concept called “risk-based approach” – a risk management parlance
of materiality, impact and likelihood of a risk, driving relevant mitigation
responses. In essence, risks identified (inherent risk) would need to be
assessed against relevant mitigating controls so as to conclude whether any
residual risks that remain unmitigated are material enough to warrant
additional intervention. In other words, the NRA is not meant to list
everything that is wrong in a country, just the materially important items that
impact ML and TF.
The first problem with Somalia’s NRA is one of internal governance
and policy-making discipline. Here, an important, and the first ever, government
document that is meant to provide authoritative picture of the ML and TF
threats facing the country has been published without internal oversight. It
should have been reviewed and properly considered by the Council of Minsters
(or appointed committee) before publication to ensure proper consideration of
its contents, and confirm whether the overall approach could be endorsed. It
should also have been laid before parliament, given the strategy to address the
risks contained in the report requires significant legislative response and
impacts the whole country. However, it is not clear in the NRA who scrutinised the
document and who signed it off for publication.
Second, there
are no case studies or other quantitative information, supporting the basis for
risk assessment conclusions (be it regulatory summaries or externally published
financial information from the financial services firms). This is explained
away as being due to a wide-spread industry-regulator mistrust and “known”
problems in Somalia, making risk rating conclusions in the NRA impossible to
scrutinise. The technical aspect of the NRA also conflates a number of
disparate concepts – vulnerabilities, risks, risk impact and likelihood,
mitigating controls, adequacy of design and operating effectiveness of
regulations / laws. Every vulnerability is not a high risk, and every high risk
is not likely to crystallise. Equally, laws might be adequately designed, but ineffectively
implemented. All of these need to be considered in relation to specific risk
areas. The NRA mixes up apples, bears and bananas and comes up with trees.
Third, there are 182 recommendations in the NRA to fix everything
wrong in Somalia – extraordinary in itself and beyond a risk-based approach. Some
of the recommendations are inherently contradictory, most are overlapping, others
are open-ended or simply unachievable. As an example of this, the
recommendation to develop “beneficial ownership” law for companies is something
even the G7 has not done properly and hardly a material risk for Somalia. It is
also impossible to distinguish between what is an area for improvement; an
unmitigated material risk whose impact and likelihood are high and needs urgent
response; a non-material risk whose impact is low or adequately mitigated; a disjointed
area that requires policy response; a gap in intelligence capabilities that
requires improvement; or an insufficient knowledge about risks in general. Because
the recommendations are not specific, it would be impossible to articulate what
the relevant policy / legislative response should be. As the government faces
competing and difficult priorities, there is no clear prioritisation of
critical recommendations against high-risk areas, what intervention the government
can make within what timelines; the low-hanging fruits to pick first, and how
to measure success. No one seems to have asked how on earth would 182
recommendations help the government prioritise response effectively?
Fourth, the NRA
lists a whole range of collaborators and stakeholder participation – from ministries
to banking and remittance companies. However, large sections of the report are
accusatory in tone, blaming the government, financial services industry,
commercial entities and non-bank financial institutions for lack of
participation and wilful disregard of their compliance obligations. These
remarks are reputationally damaging to both the government and the industry as
a whole. It is one thing to outline limitations in participation,
inconsistencies in reporting obligations and law enforcement deficiencies, but
quite another to paint Somalia as a country whose financial services industry
is actively undermining compliance laws, and operating without any national or
international standards. Here, the Somali government is blaming itself and the
wider industry in a report that the government itself is producing. It is a
remarkable feat of incoherence indeed.
Fifth, there is
no positive evidence that outlines how Somalia’s financial services industry
has gradually transformed over the years; the controls they have in place and
their efforts to tackle ML and TF risks; outcomes from the regulatory
supervisory reviews by the Central Bank of Somalia (CBS) and FRC hardly get a
mention; nor the effectiveness of the regulations that are in place and
compliance status. In the absence of this, the NRA is conveying a fatalistic and
possibly erroneous view that there are no visible governance standards in the
country. The NRA blames banks and remittance companies for not providing
relevant information to the FRC (i.e., suspicious activity reports),
undermining the FRC’s ability to build an intelligence picture of the risks.
What is not mentioned of course is why and, if indeed true, what should be done
about it. The point is framing concerns and gaps as risk categories, rather
than a defeatist and accusatory tone in a report that has global audience. For
instance, there are industry concerns about FRC’s ability to safeguard
confidential information; the lack of credible governance structure and
expertise within the FRC; regulatory incoherence between FRC and CBS; the
absence of appropriate mechanism for sharing information and safeguarding
data.
Sixth, a significant
proportion of the NRA is copy and paste from different outside sources - largely
analysis based on perception. For instance, some of the information is focused
on foreign governments’ views, outlining and how the threat from Somalia is
impacting the region; other areas make reference to issues about the 4.5 Qabiil
model and how it stops the persecution of crimes; use of outdated information
from outside publications is also pervasive in the report; extracts from laws, regulations
and audit conclusions are scattered across many sections in the report without
cogent contextual explanation. The danger of this is that the NRA has a life of
its own, becoming an all-purpose incomprehensive document, veering into areas
far removed from its intended scope. It also means it is no longer an
evidence-based assessment of risks, but risks perpetuating a collection of narratives
that are unrelated to the scope of the NRA.
Seventh, a
consequential statement in the NRA is that the banks, remittance companies and
other non-bank financial firms do not have basic know-your-customer controls, nor
apply the regulations in full; and that their AML /CFT processes are inadequate.
For mobile money operators (“MMOs” - which are highlighted as the biggest
risk), the NRA claims that the operators are not in compliance with Somalia’s
AML/CFT law. If this is factually correct, it means the Somali government is
confirming that no entity adequately complies with Somalia’s AML/CFT law; the
CBS / FRC are not capable regulators that can take action; and the CBS gives
licenses to banks, remittance companies and MMOs even though they do not comply
with the AML/CFT law and mobile money regulations. If this is the Somali
government’s considered view, it has very significant consequences for the
debt-relief programme, the financial services industry and the country as a
whole. It is also very damaging for Somalia Plc.
Policy-making
incontinence
Finally, no one doubts
the risks facing Somalia. Somalia’s AML/CFT laws are still comparatively new
and effective enforcement is still developing; law enforcement maybe disjointed;
and regulatory incoherence between the CBS and FRC, as well as political instability,
remain overarching constraints, impacting the country’s overall risk mitigation
strategies. However, the picture the NRA paints about the financial services landscape
is too pessimistic to be plausible. While there are good areas in the NRA that
talk about how the regulators are working to address some of these risks, these
are entirely lost in the background noise. The overall NRA also appears to be
pitched as a request-for-funding exercise, rather than a rigorous assessment
and prioritisation of risks. It is why it is published as incomplete and is without
action plans.
The NRA also misses
other opportunities to highlight the progress Somalia’s financial services
firms have made over the years. In this context, there are questions for the
government and the financial services firms that are listed in the NRA as
collaborators. The government needs to rein in these sorts of policy-making
incontinence and design adequate governance framework around the review and publication
of sensitive documents that set out official government view. Firms that are
central to the conclusions in the NRA need to review the report to ensure the
information about their businesses is accurate.
International
banks, regulators and investors will have sight of Somalia’s NRA and the FATF
will publish it in due course. This will
have significant impact on Somalia Plc and investor perception, sentiment and
foreign direct investment flows. The recommendations from the NRA will also be
critical to Somalia’s mutual evaluation in two years’ time. That is why the conclusions
must be factually accurate, not fatalistic but balanced; risk-based, rather
than collection of irrelevant narratives; and have clearly articulated areas of
focus. Unfortunately, Somalia’s NRA achieves none of this.
Related Article:
Somalia’s
Mutual Evaluation Risk (hiiraan.com)